A Guide to HIPAA Compliance in the Cloud

Cloud computing has transformed business services globally, and today, U.S. healthcare organizations are reaping the benefits of investing in cloud services early. However, U.S. healthcare and cloud service providers are bound by the Health Insurance Portability and Accountability Act (HIPAA); this legislation was created to protect health information and patient data privacy and can complicate the transition to the cloud.

Some healthcare organizations may argue that legislation has slowed the desire to move healthcare services to the cloud. However, the rise of HIPAA-compliant IT hosting and Managed Services providers like Atlantic.Net has established a great trust in IT services designed to enforce the Administrative, Physical, and Technical safeguards of HIPAA compliance in the cloud.

HIPAA and Cloud Computing

HIPAA was created in 1996 when the Internet was in its infancy and Cloud computing services did not yet exist. Over time, as businesses digitized workloads and the first footprints of public cloud services computing took a foot in private data centers across the U.S., Healthcare businesses were trying to understand how the newly founded legislation, including the HIPAA Security rule and HIPAA Privacy Rule amendments in 2003, would affect their business.

Healthcare providers were met with a dilemma: stick to old-fashioned paper records, manual processes, and cumbersome administration or venture into the unknown by attempting to become HIPAA compliant by going it alone. Thankfully, as cloud computing matured, another option was on the table: healthcare providers could now directly outsource healthcare IT systems to HIPAA-compliant cloud computing and cloud storage providers.

How to Maintain HIPAA Compliance While Engaging Cloud Providers

Atlantic.Net started its cloud computing services in 2010, and we quickly established a leading HIPAA-compliant cloud storage and hosting service over the next few years. Our business was one of the very first to give U.S. healthcare organizations the option to outsource not only data recovery and the hosting of their IT systems but also the option to purchase managed services that added real value and bolstered their accreditation of being HIPAA Compliant.

The HIPAA compliance provider must be able to meet and exceed the mandatory requirements of HIPAA regulations. This can be challenging because the number of compulsory, recommended, and preferred safeguards is difficult to quantify. Approximately 80 HIPAA rules and guidelines relate directly to the HIPAA Privacy Rule, and about 100 regulations comprise the Administrative, Physical, and Technical Safeguards of the Security Rule.

To complicate this further, while some HIPAA rules are mandatory, recommended, or simply nice to have, some HIPAA rules won’t apply to your healthcare organization! This creates a complex web of HIPAA requirements, health-related data confidentiality, integrity, and availability, so outsourcing to a HIPAA-compliant hosting partner is highly recommended.

Sign a Business Associate Agreement for Cloud Services

The very first requirement to be obtained is a Business Associate Agreement (BAA). When outsourcing, regardless of the extent of Protected Health Information (PHI) involvement, all Managed Service Providers offering HIPAA services to a covered entity (healthcare provider, health plan, or healthcare clearinghouse) must have a signed BAA in place.

The BAA outlines their business associate status, the permitted uses and disclosures of PHI, and limitations on access to healthcare data, and stipulates the safeguards to be implemented by the MSP to protect PHI. BAAs should be reviewed and updated regularly, especially when cloud services or technology change.

HIPAA Security Rule

To be HIPAA compliant in the cloud, it is essential that your IT cloud services are configured and in compliance with the mandatory parts of the Security Rule. The security rule is divided into Administrative Safeguards, Physical Safeguards, and Technical Safeguards.

Administrative Safeguards

The Administrative Safeguards of the Security Rule revolve around establishing policies and procedures to manage security programs.

Here are the key elements:

• Security Management Process: Covered entities must create and implement policies and procedures to manage and maintain their security programs. This involves conducting risk assessments, managing risks, resolving risk issues, setting security policies, and providing relevant training to the workforce.
• Security Awareness and Training: A HIPAA-Covered Entity and the Business Associates workforce must be educated about HIPAA security policies and procedures to safeguard protected health information.
• Workforce Security: The business hiring, termination, and authorization process and procedures must be reworked for personnel accessing ePHI. This includes additional background checks for employees who have access to PHI systems.
• Disaster Recovery Plan: Establishing a plan to restore operations and ePHI access in emergencies or disasters. This includes technical requirements and process changes, such as having access to alternative business premises in the event of a disaster.
• Contingency Plan: Outlining procedures to recover ePHI in the event of its loss, corruption, or destruction. This should be part of a wider business continuity plan that includes a detailed response of who is responsible for each part of the contingency plan.

Physical Safeguards

Physical Safeguards under the HIPAA Security Rule focus on controlling access to electronic medical records and protecting physical equipment storing ePHI.

Key requirements include:

• Facility Access Controls: Implementing physical barriers and controls such as locks, security cameras, controlled entry systems, and visitor logs to restrict unauthorized access to data centers, healthcare equipment, and healthcare devices.
• Workstation and Device Security: Securing workstations and devices accessing protected health information with robust passwords, encryption, and activity monitoring. Common fixes include screen locks and timeouts (usually after 30 seconds).
• Media Control: Establishing procedures for the use, transfer, disposal, and reuse of electronic media containing ePHI to prevent unauthorized access or loss. One example is medical imaging; the HIPAA rules define how images are stored, shared, and accessed.
• Documentation: Documenting physical security policies and procedures to demonstrate compliance with HIPAA. You need to know what IT systems contain ePHI, what ePHI you have saved to cloud storage, and how it is processed.
• Addressable Safeguards include additional physical safeguards based on specific risk assessments, such as emergency evacuation procedures and 24/7 security guard coverage.

Technical Safeguards

The Technical Safeguards outlined in the HIPAA Security Rule aim to protect ePHI through technological measures.

Access Control:

• Unique User IDs and Passwords: Enforcing strong password policies and regular changes to prevent unauthorized access. User access must adhere to the principle of least privilege.
• Multi-Factor Authentication (MFA): Implementing additional security measures like one-time codes or biometrics is mandatory. MFA should protect access to sensitive data such as websites, imaging data stores, etc.
• Role-Based Access Control (RBAC): Granting ePHI access based on authorized personnel’s roles and responsibilities. This is controlling data on a ‘need to know’ basis.

Data Security:

• Encryption: It is essential to encrypt ePHI at rest and in transit to safeguard it from unauthorized access. It is one of the most effective ways of protecting sensitive data.
• Data Integrity: Implementing measures to ensure the accuracy and completeness of ePHI, preventing unauthorized alteration. Knowing what in-scope data your systems process is a mandatory requirement of HIPAA, and the ability to restore data from backup is essential.
• Audit Controls: Track and log user activity related to ePHI access for identifying potential breaches by using an SIEM solution and an intrusion protection service. Automate alerts need to be responded to around the clock; MSPs will have 24x7x365 support that can help here.

Transmission Security:

• Secure Communication Protocols: Use protocols like HTTPS and TLS/SSL certificates to encrypt protected health information communications over the Internet.
• Email Security: Employing robust email security measures like encryption and digital signatures for ePHI sent via email. Tools are available that will intercept ePHI if unintentionally sent via email, blocking it before it leaves your infrastructure perimeter.
• Malware Protection: Installing and maintaining effective anti-malware software is essential to protect against viruses and data leaks.
• Software Updates: Applying security patches and updates promptly to mitigate known vulnerabilities is the most effective way to bolster your security posture. Updates should be monthly; all systems should run genuine, modern software.
• Data Backup and Recovery: Regularly backing up ePHI and having procedures for data restoration in case of loss or system failure is the easiest way to protect our system from extended outages. It also helps satisfy the HIPAA requirement of ePHI, which must always be available.

HIPAA Privacy Rule

We must also consider the HIPAA requirements and Privacy Rules to ensure HIPAA Compliance in the Cloud. The Security Rule is black and white over its requirements. However, with the Privacy rules, the conditions are not so clear cut.

The HIPAA Privacy Rule outlines situations where using and sharing PHI without individual permission is okay. These scenarios involve treatment, payment, healthcare operations, electronic health records, public health efforts, and specific conditions. Redacted protected health information stored data can also be used to train healthcare professionals or in educational studies.

The HIPAA Privacy Rule gives people certain rights regarding their PHI.

• Access: Patients can view and inspect their medical records.
• Amendment: Patients can ask to fix any wrong or incomplete information.
• Accounting of Disclosures: Patients have a right to know who has seen their PHI.
• Confidentiality: Patients can also limit who else gets to know about their PHI.

The HIPAA Privacy Rule includes several other vital components.

• Minimum Necessary Standard: This mandates HIPAA-covered entities to only use, disclose, or request the least amount of PHI necessary for their intended purpose.
• Notice of Privacy Practices: A Covered Entity must craft and provide individuals with a clear notice detailing their privacy practices and the rights individuals have regarding their PHI.
• Administrative Safeguards: involves specific policies and procedures that a covered entity needs to adopt to safeguard PHI. This includes implementing security measures, training, and establishing breach notification protocols.
• Compliance Reviews and Complaints: This section explains how the Department of Health and Human Services (HHS) enforces the rule by conducting compliance reviews and investigating individual complaints.
• Additional Provisions: Covering a range of other subjects like marketing, research, and genetic information, these provisions further elaborate on how the rule applies in various contexts.

The Complexities of HIPAA

Example: HIPAA Compliant Cloud Storage

To help illustrate how the Privacy and Security rules impact your healthcare business, let’s consider a customer who uses Atlantic.Net HIPAA-compliant cloud storage. Storage is one of the most popular HIPAA services our customers choose. Data protection and data encryption are at the cornerstone of the cloud service, and it’s essential to enforce data classification and prevent a data breach.

HIPAA-compliant cloud storage requires these safeguards to be in place:

• Network Encryption: Use NIST cryptographic standards whenever you transmit protected health information.
• Data Access controls: As per the HIPAA rules, each user must have a unique username, password, and PIN.
• Authenticate ePHI: You must authenticate ePHI and protect it from unauthorized changes.
• Encrypt Devices: The storage and all devices connected to it must be encrypted.
• Audit Activities: All user access must be logged.
• Control Facility Access: Your Provider must carefully track all data center access, including employees, engineers, and site visitors.
• Inventory: All hardware, mobiles, and devices used to connect to the cloud storage must be inventoried.
• Block All Access By Default: Access to every must be blocked (except of course a few authorized users).
• Risk Assessment: Constantly evaluate Access controls and data handling practices.
• Train Your Staff: Employees must be trained to use cloud storage.
• Document Security Incidents: Employees should recognize and report any security event.

As you can see, these are just the high-level requirements of a single HIPAA-compliant cloud service. Your HIPAA-compliant provider is responsible for multiple services. It is easy to see how complicated this entire process gets when you increase the scale of the operation.

Atlantic.Net HIPAA Hosting

Are you ready to take the next step to discover more about HIPAA Compliance in the cloud? Atlantic.Net has the complex infrastructure required for HIPAA hosting and HIPAA-managed services available.

Here are the key HIPAA Services available from Atlantic.Net:

• Shared, VPS, Dedicated, and Cloud Server Hosting: Choose the hosting plan that best suits your needs, all with HIPAA compliance built-in.
• Business Associate Agreement (BAA): Atlantic.Net signs a BAA with you, outlining both parties’ responsibilities for protecting PHI.
• Security Features: Strong security measures like intrusion prevention systems, firewalls, vulnerability scans, and encrypted backups help keep your data safe.
• Compliance Certifications: Atlantic.Net is HIPAA audited and SOC 2 and SOC 3 certified, demonstrating their commitment to data security.
• Managed Intrusion Prevention System: Continuously monitor your network for suspicious activity and prevent attacks.
• Anti-Malware Protection: Protect your systems from malware and other threats.
• Dedicated Firewalls & Encrypted VPN: Secure your network perimeter and encrypt your data in transit.
• Log Management and Analysis: Keep track of all activity on your systems and identify potential security issues.
• HIPAA-Compliant WordPress Hosting: Run your WordPress website with the same level of security and compliance as your other HIPAA data.
• HIPAA-Compliant Email Hosting: Securely send and receive email with PHI protection.
• HIPAA-Compliant Disaster Recovery: Ensure business continuity in the event of a disaster with a HIPAA-compliant backup and recovery solution.

Are you in need of an infrastructure that can protect the health data of your organization? At Atlantic.Net, whatever your technical requirements, we can offer a top-grade HIPAA-Compliant Hosting solution. Get a HIPAA-Compliant Server Cost from one of our experts.

Get a free consultation today!